safe-bash `test`/`[`: deeply nested `\( \)` hits a raw stack overflow reported as "Maximum call stack size exceeded"

[kamilio]

Where: packages/safe-bash/src/commands/predicates.ts — the recursive test/[ expression parser has no depth cap; argv is bounded only by the 64 KB cap / maxExpansionFields.

PoC:

test \( \( … ×3000 a \) \) … ×3000; echo rc=$?

Measured: script exit 0, rc=1, stderr test: Maximum call stack size exceeded, 31 ms, no crash.

Impact: (e) — error-contract wart only: a raw RangeError is caught and surfaced as a test failure rather than a classified diagnostic. Analogous to closed #583 (arithmetic).

Fix: depth counter (e.g. 256) → test: too many arguments / syntax error before recursion.

Found in security audit v3 (2026-09-07).

[kamilio]

Resolved and verified on remote main at 3e4af4b. test and [ now reject nesting beyond 256 parentheses/negation levels before recursive descent, using the normal usage diagnostic and status 2 instead of leaking a host stack failure. Fresh regression RED: 10 failures; GREEN: all 19 pass, with adjacent semantic controls. Root normal build, 201 focused integration/contract controls, and guarded repository lint passed. Actual diagnostics independently asserted and screenshot inspected. The larger #649 candidate remains local and is not included in this push; release publication is monitored separately.